Home

This wiki teaches you how to use the Hammer parser combinator library by building real protocol parsers in C. Hammer lets you declare what valid binary input looks like and handles the low-level parsing for you.

---

Recommended Reading Order

If you're new to Hammer, go through these in order:

1. What makes Hammer, Hammer? - Understand why Hammer is useful for secure parsing.
2. Getting Started - Install Hammer and verify your setup.
3. Hammer Fundamentals - Core concepts: HParser, H_RULE, data types, combinators.
4. Pick an example (start with NTP) and follow it page by page.
5. Keep the Quick Reference open as a companion.

If you already know the basics, jump straight to an example or use the Quick Reference to look up specific functions. For testing, extending, or building Hammer for embedded systems like RTEMS, see Unit Testing, Extending Hammer, and Using RTEMS.

---

Protocol Examples

Each example walks through a complete, working parser for a real network protocol.

Protocol	Difficulty
NTP (Network Time Protocol)	Beginner
DNS (Domain Name System)	Intermediate
TFTP (Trivial File Transfer Protocol)	Beginner

Want to add a new protocol example? See Adding a New Example.

---

Tip: Use the sidebar to navigate between pages, or follow the "Next" / "Previous" links at the bottom of each page.

---

Further Reading

Background on the security principles that motivate formal parsing approaches like Hammer.

• DARPA SafeDocs - A DARPA program that developed open-source tooling and methodologies for building high-assurance parsers, reducing the attack surface introduced by complex data formats.

• Research Talk: DARPA SafeDocs: an approach to secure parsing and information interchange formats - Talk by Sergey Bratus (DARPA) on why replacing ad hoc input validation with formally proven parsers is critical, and how SafeDocs and Microsoft Research EverParse approach this problem. Motivated by a DARPA/MITRE estimate that ~80% of software vulnerabilities have incorrect input validation as their root cause.

• LangSec - Language-Theoretic Security - An academic and practitioner community that treats input handling as a formal language recognition problem. LangSec argues that any software processing untrusted input is effectively an interpreter, and that ad hoc validation is fundamentally insufficient; the only robust path is to define valid inputs as a formal language and parse them with a correct, complete recognizer.